# How to connect Intercom to Hermes Agent (no API keys)

> Connect Intercom to Hermes Agent with ClawLink: 133 tools via hosted OAuth, no API keys, no config.yaml editing. Official Intercom MCP is US-hosted with ~13 tools; the comparison is on this page.

Web version: https://claw-link.dev/hermes/intercom

Most guides for giving Hermes Agent Intercom access start with registering your own OAuth app or pasting API keys into env files, then leave the token refresh and tool wiring to you. ClawLink gives Hermes a more practical Intercom setup: pair once in the browser and your always-on Hermes agent can act on Intercom for you, reading and doing real work on your behalf with no auth, token refresh, or tool wiring to build yourself.

**Start here — paste this into Hermes to set up ClawLink:**

> Set up ClawLink for Hermes and tell me when it's ready.
> 1. Install the plugin: `hermes plugins install ClawLink-HQ/hermes-plugin --enable`
> 2. Start pairing with `hermes clawlink begin`. It prints an approval link, so show me the link and stop, don't wait.
> 3. I'll approve it in my browser, then reply "approved".
> 4. When I say approved, finish setup: `hermes clawlink finish`
> 5. Then run `hermes clawlink test` and tell me whether ClawLink is ready.

## Setup

It takes three steps to connect Hermes to Intercom.

1. **Install ClawLink** — add the plugin to Hermes Agent once.
2. **Connect Intercom** — one-click OAuth in the ClawLink dashboard.
3. **Use it from chat** — ask Hermes Agent in plain English.

**Alternative for any agent (no plugin needed):** if the Hermes Agent plugin route isn't available or doesn't work, any AI agent with shell access can use the ClawLink CLI instead:

```bash
npx -y @useclawlink/cli login          # sign in via browser — no API key to paste
npx -y @useclawlink/cli connect intercom  # connect Intercom (browser OAuth)
npx -y @useclawlink/cli actions intercom  # list available actions
npx -y @useclawlink/cli run intercom <action> --input '<json>'  # execute (add --confirm for writes)
```

### Install by command

The prompt above walks Hermes through this. By hand, it is four commands and a browser approval:

```bash
hermes plugins install ClawLink-HQ/hermes-plugin --enable
hermes clawlink begin    # prints an approval link — open it and approve
hermes clawlink finish   # after approving in the browser
hermes clawlink test
```

Then connect Intercom in the [ClawLink dashboard](https://claw-link.dev/dashboard) — a one-click OAuth approval, no API keys.

Verify the connection by asking Hermes:

> List my open conversations and for each one tell me the assignee, the workspace it came from, and whether a teammate has already replied. Use intercom_list_all_activity_logs to catch anything not in the conversation list. Do not assign or close anything.

### Using a different agent?

The Hermes plugin is one client of ClawLink's MCP server. Claude Code, Cursor, Codex, or any agent that can run a shell command pairs with the same ClawLink account through the CLI:

```bash
npx -y @useclawlink/cli login
```

`login` opens the same browser approval and stores a credential locally. Once Intercom is connected in the dashboard, that agent calls the same 133 Intercom tools over MCP. Full setup for MCP clients and shell agents: [connect apps to any AI agent](https://claw-link.dev/learn/connect-apps-to-any-ai-agent).

## Intercom MCP for Hermes

Looking for a Intercom MCP server for Hermes Agent? ClawLink connects Intercom to Hermes Agent and exposes 133 Intercom tools your agent can call over [MCP](https://claw-link.dev/learn/what-is-an-mcp-server), with [hosted auth](https://claw-link.dev/learn/oauth-for-ai-agents) and nothing to run or maintain yourself. Using OpenClaw instead? The [OpenClaw Intercom integration](https://claw-link.dev/openclaw/intercom) runs on the same hosted Intercom provider and the same 133 tools; OpenClaw installs ClawLink through a ClawHub skill instead of the Hermes pairing commands.

Search results currently teach two ways to connect Intercom to Hermes, and neither is what this page does. The first is a Composio Connect walkthrough: install their CLI, then hand-edit `~/.hermes/config.yaml` to add an `mcp_servers:` block with an API key, then restart the daemon. The second is Intercom's own official remote MCP server, which is genuinely hosted and browser-OAuth based, but is US-hosted only, carries roughly 13 core tools, and is read and search biased. ClawLink is a third option with a different trade: pair Hermes once, approve Intercom's consent screen in the browser, and the 133 tools below are callable from chat. No config file is edited, nothing runs on your machine, and the connection is not tied to a US data region the way Intercom's own hosted MCP is. If you want Intercom's own Fin agent instead of an external one, that lives inside Intercom's workspace settings and needs no API key either, but it stays inside Intercom; this integration is for an agent that works across all your connected apps.

## What the Hermes Agent Intercom integration can do

133 Intercom tools are ready for Hermes Agent once the account is connected. The 30 below are the ones people reach for most; your agent can call all 133.

### 30 of 133 Intercom tools for Hermes

| Tool | What it does |
|---|---|
| **Add tag to contact** `intercom_add_tag_to_contact` | Add a tag to a contact in Intercom |
| **Assign conversation** `intercom_assign_conversation` | Assign a conversation to an admin or team |
| **Attach contact to company** `intercom_attach_contact_to_company` | Attach a contact to a company in Intercom |
| **Close conversation** `intercom_close_conversation` | Close a conversation in Intercom |
| **Create an article** `intercom_create_an_article` | Create a new article in Intercom |
| **Create contact** `intercom_create_contact` | Create a new contact in Intercom |
| **Create conversation** `intercom_create_conversation` | Create a new conversation in Intercom |
| **Create data event** `intercom_create_data_event` | Submit a data event to Intercom |
| **Download data export** `intercom_download_data_export` | Download content data export from Intercom |
| **Find tag** `intercom_find_tag` | Retrieve details for a specific tag by its ID |
| **Get a contact** `intercom_get_a_contact` | You can fetch the details of a single contact |
| **Get content import source** `intercom_get_content_import_source` | Retrieve a content import source by its ID |
| **Get conversation** `intercom_get_conversation` | Retrieves a specific conversation by ID with all messages and details |
| **Get counts** `intercom_get_counts` | Retrieve summary counts for Intercom app entities including companies, users, leads, tags |
| **Get custom object instance by external ID** `intercom_get_custom_object_instance_by_external_id` | Retrieve a custom object instance by its external_id |
| **Get external page** `intercom_get_external_page` | Retrieve an external page from Fin Content Library by ID |
| **Get ticket** `intercom_get_ticket` | Retrieve a ticket from Intercom |
| **Get ticket type** `intercom_get_ticket_type` | Retrieve details for a specific ticket type by its ID |
| **Identify an admin** `intercom_identify_an_admin` | You can view the currently authorised admin along with the embedded app object (a "workspace" |
| **Jobs status** `intercom_jobs_status` | Retrieve the status of job execution |
| **List all activity logs** `intercom_list_all_activity_logs` | You can get a log of activities by all admins in an app |
| **List all admins** `intercom_list_all_admins` | You can fetch a list of admins for a given workspace |
| **List all articles** `intercom_list_all_articles` | You can fetch a list of all articles by making a GET request to |
| **List all collections** `intercom_list_all_collections` | You can fetch a list of all collections by making a GET request to |
| **List all companies** `intercom_list_all_companies` | You can list companies |
| **List all help centers** `intercom_list_all_help_centers` | You can list all Help Centers by making a GET request to |
| **List all macros** `intercom_list_all_macros` | Fetch a list of all macros (saved replies) in your workspace for use in automating responses |
| **List all notes** `intercom_list_all_notes` | You can fetch a list of notes that are associated to a contact |
| **List attached companies for contact** `intercom_list_attached_companies_for_contact` | You can fetch a list of companies that are associated to a contact |
| **List attached contacts** `intercom_list_attached_contacts` | You can fetch a list of all contacts that belong to a company |

## Example prompts

**Triaging an inbox**

> List my open conversations and for each one tell me the assignee, the workspace it came from, and whether a teammate has already replied. Use intercom_list_all_activity_logs to catch anything not in the conversation list. Do not assign or close anything.

**Contact profile**

> For the contact whose email is \<email>, look them up, list their attached companies with intercom_list_attached_companies_for_contact, and tell me what conversations exist on this contact across the last 30 days.

**Help center audit**

> List all articles with intercom_list_all_articles and their collections. Tell me which collections have no articles, which articles have not been updated in 90 days, and how many views the top five articles have.

**Draft, then send**

> Create a draft reply for conversation \<conversation id>. Do not send it. Show me the draft and the contact's name and company so I can approve before you assign or reply.

## How the Intercom tools behave

Details that decide whether an Intercom prompt returns fast or fails permission-shaped.

- **Ids, not emails or names.** Contacts and conversations are addressed by id. `intercom_get_a_contact` can search, and the listing tools return the ids; an id invented in the prompt fails with a 403-shaped error.
- **Conversation writes are visible.** Assigning, closing, replying, and creating conversations all notify people on the workspace. Say explicitly when the agent may write versus draft.
- **Contacts attach to companies.** `intercom_attach_contact_to_company` and the attached-companies readers are how org-level questions get answered, and company context changes what a reply should say.
- **Admins are readable.** `intercom_list_all_admins` and `intercom_identify_an_admin` answer who-is-who questions and are the first diagnostic when a 403 appears, since they show which teammate the connection acts as.
- **Content tools are broad but separate.** Articles, collections, help centers, macros, and notes each have their own listing tool, so "summarize the help center" needs the agent to call several tools rather than one.

## ClawLink vs. building it yourself

The alternative to ClawLink is usually manual OAuth app setup plus your own token handling, permission troubleshooting, and tool plumbing for Hermes Agent. That is fine if you want to build and maintain the integration yourself. Most teams just want Intercom working from chat.

| | Manual | ClawLink |
|---|---|---|
| **Connection flow** | Register a Intercom app, configure redirect URLs, manage consent details, and reconnect users when auth settings drift. | Users connect Intercom through the hosted browser flow and ClawLink keeps the token lifecycle out of your app code. |
| **Ongoing maintenance** | You own refresh logic, permission debugging, environment config, and every provider-specific edge case for Intercom. | ClawLink handles the repetitive integration plumbing so your team can focus on the workflow instead of the infrastructure. |
| **Agent usability** | You still need to expose the right Intercom actions to the runtime in a format your agent can reliably use. | 133 tools for Intercom are already exposed through ClawLink, so the agent can read and act from chat immediately. |

## ClawLink vs. Composio

Composio also exposes Intercom to AI agents. It is developer infrastructure: Python and TypeScript SDKs, an MCP server, and a catalog past 1,000 apps, aimed at teams shipping agent products. ClawLink is built for Hermes Agent users instead. You install the plugin once, connect Intercom in the browser, and the 133 tools above work from chat. There is no SDK, no config file, and no API key handling. Choosing between them? Read the full [Composio alternatives](https://claw-link.dev/hub/composio-alternatives) comparison.

### Hermes paired but still can't use Intercom
Pairing is a two-step handshake: run `hermes clawlink begin`, approve the link in your browser, then run `hermes clawlink finish`. If you ran finish before approving, or the approval link expired, run `hermes clawlink begin` again to get a fresh link. Confirm the plugin was installed with `--enable`, then verify with `hermes clawlink test`.

### Connection succeeds but no tools appear
Reconnect Intercom from the dashboard, then start a fresh chat if the runtime still has the old tool catalog loaded.

### "Tool schema not loaded yet" error when calling Intercom tools
Intercom tool schemas load on demand the first time a tool runs and are cached after that, so this error usually clears on its own: wait a few seconds and retry the same request. If every Intercom call keeps failing with it in a fresh chat, reconnect from the dashboard, and contact support if it still persists — that pattern points to a configuration problem on our side, not something you can fix by reconnecting again.

### Intercom returns 403 or "permission denied" on one action while others work
Two usual causes. The connected account may not have access to the specific workspace, inbox, store, or project in the request — check that first. If access looks right, the agent may have sent a placeholder value (like "YOUR_ID" or an example id from documentation) instead of a real one: ask it to run a list or search tool first, then retry the action with a real id from those results. Most failures at this stage are one of these two, not ClawLink bugs.

### Intercom returns 403 on an action although the account is connected
When the connection is healthy and one action still fails, the problem is authorization, not authentication: the token is fine, the permission is missing. The taught cause order: the connected user's role inside the workspace (teammate permissions decide what they can do, and a restricted teammate fails writes that reads succeed on), then stale OAuth scopes (a grant made before a permission change keeps its old limits, and disconnect then reconnect from the dashboard re-issues it), then the arguments (a placeholder or invented contact or conversation id returns permission-shaped errors because Intercom hides what you cannot see). State which of the three you checked before touching anything else.

Ask the agent to diagnose it:

```text
Call intercom_list_all_admins and intercom_identify_an_admin. Tell me which teammate this connection acts as and whether they have workspace admin rights, then quote the exact error from the failed call. Do not retry it yet.
```

### Intercom tools are missing, or a tool name is not found
Two different failures. If Hermes shows no Intercom tools at all, the connection or the pairing is incomplete: confirm both `hermes clawlink begin` and `hermes clawlink finish` ran and Intercom shows as connected in the dashboard, then reconnect and start a fresh chat. If most tools work and a single name fails, the name is wrong rather than missing, and the error lists the closest real ones. The cause search results teach for this symptom is a stale client connection or an outdated remote server URL in a local client's config, which does not apply here: there is no local MCP endpoint to update. There is one first-call timing case: schemas load on demand, so the opening Intercom call in a fresh session can arrive before the catalog and needs one retry.

Ask the agent to diagnose it:

```text
List the Intercom tools you actually have access to. If there are none, say so plainly. If there are, tell me which one fetches a conversation and use that exact name.
```

### Intercom returns 403 for one contact or conversation but not others
This is the placeholder-ID trap in its purest form and it is a cause no engine teaches: the agent is calling a real tool with a made-up or copied-from-an-example id. Intercom answers with the same permission-shaped error it uses for genuinely restricted objects, so the failure reads as an authorization problem when the id is simply wrong. Have the agent search first with intercom_list_all_activity_logs or a listing tool to find the real id, or paste the Intercom URL of the conversation or contact into the chat. Only after confirming the id is real should you look at roles or scopes.

Ask the agent to diagnose it:

```text
Find the conversation or contact I am asking about by listing recent items, not by retrying the failed id. Show me the id you intend to use next and the object type it belongs to before you call anything.
```

### OAuth finished in the browser but the account is still missing
Try reconnecting Intercom and complete the consent flow in the same browser session. Partial OAuth approvals or switching accounts mid-flow can leave the connection incomplete.

### Is there a Hermes Agent Intercom integration?
Yes. ClawLink is the fastest way to connect Hermes to Intercom: link your Intercom account once in the browser and Hermes Agent can call the Intercom API through 133 ready-made tools — no custom code or token handling.

### How do I connect Intercom to Hermes with ClawLink?
Install the plugin with `hermes plugins install ClawLink-HQ/hermes-plugin --enable`, then pair once: run `hermes clawlink begin`, approve the link in your browser, and run `hermes clawlink finish`. Connect Intercom in the dashboard and Hermes can use it from the next message — no config files or API keys to manage.

### How long does it take to connect Intercom to Hermes Agent?
About two minutes. Sign in, click Connect next to Intercom in the dashboard, authenticate, and Hermes Agent can use it from the next chat message.

### Why use ClawLink instead of wiring Intercom up myself?
The alternative to ClawLink is usually manual OAuth app setup plus your own token handling, permission troubleshooting, and tool plumbing for Hermes Agent. That is fine if you want to build and maintain the integration yourself. Most teams just want Intercom working from chat.

### How does this compare with Intercom's official hosted MCP server?
Intercom now ships its own remote MCP server at mcp.intercom.com/mcp with a browser OAuth login, which is a real hosted option and is what Google's AI Overview now recommends. The tradeoffs to know: it is US-hosted only (an EU variant exists at mcp.eu.intercom.com/mcp), and it exposes roughly 13 core tools that are read and search biased. ClawLink connects to the same Intercom API through hosted OAuth with 133 tools, so the number is not comparable tool for tool; the official server is a thin official slice, this integration is the broader account surface. Pick on where your data is hosted and how many operations you need, not on who hosts the OAuth.

### Do I need to edit Hermes's config file to use this?
No. The config-file route exists and is what most guides teach: a Composio Connect CLI install, an `mcp_servers:` block in `~/.hermes/config.yaml`, an API key pasted in, a daemon restart. This page's setup replaces all of it: install the plugin once, run `hermes clawlink begin` and `hermes clawlink finish`, connect Intercom from the dashboard, and the tools appear in a fresh chat. Nothing about this setup lives in a file Hermes reads at startup.

### What can the agent do in Intercom?
Conversations and contacts are the core: list, assign, close, and create conversations, create and look up contacts, attach contacts to companies, tag contacts, and read the activity log, admins, articles, collections, companies, help centers, macros, and notes. Writes to flag are conversation assignment and closing, contact creation, tags, and article creation, since those change things customers and teammates see. The read tools are broad enough that most support questions are answerable without writing anything.

### Is it safe to connect Intercom to an AI agent?
The safety answer engines give is a list of guards: strict permission boundaries, prompt-injection awareness, avoiding over-permissioning, PII redaction, and human escalation. This connection satisfies the mechanics: the OAuth grant is scoped to what the tool table on this page shows, conversation content is handled through your connected account rather than stored keys, and revocation from the ClawLink dashboard is immediate. The behavior guardrails are yours: connect an account with the access the agent actually needs, keep draft-mode replies for customer-facing writes, and have the agent flag anything containing PII before it sends it.

### Does the connection need to be reconnected when Intercom changes permissions?
Yes, and that is a taught cause rather than a guess. When the connected user's role or the OAuth scopes change, actions that previously worked start failing with permission errors while reads keep working. The fix engines teach and this page agrees with is disconnect and reconnect from the dashboard so the grant is re-issued with current scopes, then start a fresh chat so Hermes picks the refreshed connection up.

### Hermes paired but still can't use Intercom
Pairing is a two-step handshake: run `hermes clawlink begin`, approve the link in your browser, then run `hermes clawlink finish`. If you ran finish before approving, or the approval link expired, run `hermes clawlink begin` again to get a fresh link. Confirm the plugin was installed with `--enable`, then verify with `hermes clawlink test`.

## Related

- [Zendesk](https://claw-link.dev/hermes/zendesk) — Manage support tickets, macros, users, and organizations
- [Hermes Gleap integration](https://claw-link.dev/hermes/gleap) — Gleap is an all-in-one customer feedback tool for apps and websites, enabling direct communication with users to build better software by discovering their everyday pain points.
- [Connect Freshdesk](https://claw-link.dev/hermes/freshdesk) — Handle support tickets, contacts, and helpdesk operations